NGINX CVE-2026-42945 Under Active Attack, Causing Worker Crashes and Potential RCE
Security researchers have observed active exploitation of a recently disclosed NGINX vulnerability just days after it was made public. The flaw affects both NGINX Plus and the open-source NGINX distribution and has already been seen being probed in the wild.
Assigned CVE-2026-42945 and rated 9.2 on the CVSS scale, the bug is a heap-based buffer overflow located in the ngx_http_rewrite_module. It impacts releases spanning from 0.6.27 up through 1.30.0. According to AI-focused security firm depthfirst, the underlying code error dates back to 2008.
If successfully weaponized, the vulnerability can let an unauthenticated attacker send specially crafted HTTP requests that either crash NGINX worker processes or-under certain conditions-lead to remote code execution. Crucially, full code execution requires that Address Space Layout Randomization (ASLR) be disabled on the target host, a mitigation that thwarts reliable exploitation in most standard deployments.
Exploitation depends on NGINX being configured in a particular way and on an attacker knowing or discovering that configuration. AlmaLinux maintainers reached a similar conclusion, saying that converting the heap overflow into dependable code execution is difficult in default setups and that systems with ASLR enabled (the default for supported AlmaLinux releases) are unlikely to be trivially exploitable for RCE. They added, however, that difficulty does not equal impossibility and emphasized that the denial-of-service aspect-crashing worker processes-is sufficiently practical to warrant urgent attention.
Administrators are urged to install the latest patches and mitigations published by F5 to protect environments from ongoing threats.
Related openDCIM attacks
At the same time, exploitation attempts targeting multiple severe vulnerabilities in openDCIM, an open-source data center infrastructure management platform. Two of the issues reported carry a CVSS score of 9.3:
- CVE-2026-28515 – A missing-authorization flaw that can allow an authenticated user to reach LDAP configuration functionality regardless of their assigned privileges. In containerized setups where REMOTE_USER is set without enforcing authentication, the endpoint may be reachable without credentials, enabling unauthorized changes to application settings.
- CVE-2026-28517 – An operating-system command injection in the report_network_map.php endpoint: a parameter named “dot” is accepted without sanitization and passed directly into a shell command, enabling arbitrary command execution.
These two bugs were discovered alongside another critical issue, CVE-2026-28516 (an SQL injection, also scored 9.3), by VulnCheck researcher Valentin Lobstein in February 2026. Lobstein demonstrated that the three vulnerabilities can be combined to achieve remote code execution across five HTTP requests and eventually spawn a reverse shell on vulnerable installations.
With multiple exploitable flaws being actively scanned and weaponized, organizations running NGINX or openDCIM should prioritize applying vendor fixes, hardening configurations (including ensuring ASLR is enabled), and monitoring for indicators of compromise to reduce exposure.